The governance indicators span a risk and opportunity framework that promotes resilience, management of data, ethics policy and training, health and safety, physical and cyber protection, regulatory compliance and anti-corruption. Nine first-priority indicators apply to organisations of every size: how many reportable or material breaches of customer privacy occurred in the year; how many cases in the year led to a bribery or corruption penalty or a dismissal; how many breaches of local environmental rules, permits or legal requirements occurred in the year; the ethics violation rate, being the proportion of personnel found in the year to have broken the code of conduct; the proportion of third-party relationships that have been through due diligence and meet anti-corruption policy; the rate of recordable work injuries and illnesses for every hundred personnel under local rules; how many labelling non-compliances with industry or regulatory requirements occurred in the year; the proportion of annual income paid out in fines, penalties, compensation and damages for breaking applicable law; and the proportion of assets and business activities that the business continuity plan covers. One second-priority indicator is aspirational: the proportion of personnel who have completed training in both physical security awareness and cyber security.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.